Because neural networks are trained on a finite-sized training dataset,
models train for multiple epochs repeating the same
examples over and over, often tens to hundreds of times.
This has consequences for the privacy of the training data.
Machine learning models are often significantly over-parameterized
[1]}, [2]}: they contain sufficient
capacity to memorize the particular aspects of the data they are trained on, even if these aspects are irrelevant to final accuracy.
This allows a wide range of attacks that leak information about the training data
given access to the trained model.
These attacks range from membership inference attacks [3]}, [4]}, [5]}, [6]}, [1]}, [8]} to training data extraction
attacks [9]}, [5]}.
